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Real Party in Interest 



Cisco Technology, Inc. 
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Related Appeals and Interferences 



None. 
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Status of Claims 



Claims 14, 17, 19-22, and 24-35 have been cancelled. 

Claims 1-13, 15, 16, 18, 23, and 36-49 have been finally rejected and are on appeal. 
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Status of Amendments 



No amendments after final have been filed. All amendments have been entered. 
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Summary of Claimed Subject Matter 

The invention relates to obtaining and correlating network account metering data from 
two distinct sources: start-stop event accounting records associated with accounting servers and 
detailed flow data collected from numerous routers throughout a network environment. 

Claim 1 is directed to method for accounting for network usage (p. 16, 11. 15-17). The 
method includes obtaining accounting start-stop event data from two or more accounting servers 
via an information bus (p. 19, 11. 9-10). The information bus contains the accounting start-stop 
event data published by the two or more accounting servers (p. 14, 11. 17-19). The method 
further includes obtaining network flow data independent from said accounting start-stop event 
data from two or more routers within a network through intermediary netflow collectors (200, p. 
19, 11. 9-10), said network flow data including data regarding the number and type of packets 
utilized by a user (p. 12, 1. 12 to p. 13 1. 9). The method further includes correlating said 
accounting start-stop event data and said network flow data into a subscriber specific call detail 
record unique to said user by matching said accounting start-stop event data associated with said 
user with said network flow data associated with said user (210, p. 19, 11. 10-18). 

Claim 13 is directed to a method for accounting for network usage (p. 16, 11. 15-17). The 
method includes parsing accounting start-stop event data from an accounting server on a 
prescribed time interval (130, p. 16 1. 22 to p. 17 1. 6). The method further includes publishing 
said accounting start-stop event data on an information bus (140, p. 17 11. 1 1-15). The method 
further includes collecting network flow data independent from said accounting start-stop event 
data from a network router and forwarding said network flow data to a network flow collector 
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(150, p. 17 11. 17-20), said network flow data including data regarding the number and type of 

packets utilized by a user (p. 12, 1. 12 to p. 13 1. 9). The method further includes aggregating 

said network flow data according to a prescribed aggregation scheme (160, p. 171. 20 to p. 18 1. 

7). The method fiirther includes parsing said network flow data from said network flow collector 

(180, p. 181. 19 to p. 19 1. 3). The method further includes publishing said network flow data on 

an information bus (190, p. 19 11. 3-7). The method further includes collecting said accounting 

start-stop event data and said network flow data at a target device that subscribes to said 

accounting start-stop event data and said network flow data along with accounting start-stop 

event data from a different accounting server and network flow data from a different router (200, 

p. 19 11. 9-10). The method further includes correlating said accounting start-stop event data and 

said network flow data into a subscriber specific call detail record unique to said user by 

matching said accounting start-stop event data associated with said user with said network flow 

data associated with said user (210, p. 19 11. 10-18). 

Claim 15 is directed to an apparatus for accounting for network usage (p. 16, 11. 15-17). 
The apparatus includes a means (target device 1 14) for obtaining accounting start- stop event data 
from two or more accounting servers via an information bus (p. 19, 11. 9-10). The information 
bus contains the accounting start-stop event data published by the two or more accounting 
servers (p. 14, 11. 17-19). The apparatus further includes a means (target device 1 14) for 
obtaining network flow data independent from said accounting start-stop event data from two or 
more routers within a network through intermediary netflow collectors (p. 19, 11. 9-10). The 
network flow data includes data regarding the number and type of packets utilized by a user (p. 
12, 1. 12 to p. 13 1. 9). The apparatus further includes a means (target device 114) for correlating 



8 of 29 



PATENT 
Serial No. 09/198,590 
Atty. Docket No. CISCO-0610 (032590-034) 

said accounting start-stop event data and said network flow data into a subscriber specific call 

detail record unique to said user by matching said accounting start-stop event data associated 

with said user with said network flow data associated with said user (p. 19, 11. 10-18). 

Claim 16 is directed to an apparatus for accounting for network usage (p. 16, 11. 15-17). 
The apparatus includes a means (accounting adaptor 82, 84, 86) for parsing accounting start-stop 
event data from an accounting server on a prescribed time interval (130, p. 16 1. 22 to p. 17 1. 6). 
The apparatus further includes a means (accounting adaptor 82, 84, 86) for publishing said 
accounting start-stop event data on an information bus (88, 140, p. 17 11. 11-15). The apparatus 
further includes a means (network flow collector 96, 98, 100) for collecting network flow data 
independent from said accounting start-stop event data from a network router and forwarding 
said network flow data to a network flow collector (150, p. 17 11. 17-20). The network flow data 
includes data regarding the number and type of packets utilized by a user (p. 12, 1. 12 to p. 13 1. 
9). The apparatus further includes a means (network flow collector 96, 98, 100) for aggregating 
said network flow data according to a prescribed aggregation scheme (160, p. 171. 20 to p. 18 1. 
7). The apparatus further includes a means (network flow adapter 108, 1 10, 1 12) for parsing said 
network flow data from said network flow collector (180, p. 18 1. 19 to p. 191. 3). The apparatus 
further includes a means (network flow adapter 108, 1 10, 1 12) for publishing said network flow 
data on an information bus (190, p. 19 11. 3-7). The apparatus further includes a means 
(subscribing target device 1 14) for collecting said accounting start-stop event data and said 
network flow data at a target device that subscribes to said accounting start-stop event data and 
said network flow data along with accounting start-stop event data from a different accounting 
server and network flow data from a different router (200, p. 19 11. 9-10). The apparatus further 
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includes a means (integrated accounting adapter 1 16) for correlating said accounting start-stop 

event data and said network flow data info a subscriber specific call detail record unique to said 

user by matching said accounting start-stop event data associated with said user with said 

network flow data associated with said user (210, p. 19 11. 10-18). 

Claim 18 is directed to an apparatus for accounting for network usage (p. 16, 11. 15-17). 
The apparatus includes an accounting adapter (82, 84, 86, p. 101. 23 to p. 11 1. 8) in 
communication with two or more accounting servers (70, 72, 74, p. 101. 23 to p. 11 1. 1). The 
apparatus further includes a network flow adapter (108, 1 10, 1 12, p. 14 11. 12-21) in 
communication with two or more routers (90, 92, 94). The apparatus further includes an 
integrating accounting adapter (1 16, p. 15 11. 16-18) in communication with said accounting 
adapter (82, 84, 86, p. 10 1. 23 to p. 1 1 1. 8) and said network flow adapter (108, 1 10, 1 12, p. 14 
11. 12-21). 

Claim 23 is directed to a program storage device readable by a machine tangibly 
embodying a program of instructions executable by the machine (1 14, p. 15 11. 12-23) to perform 
a method for accounting for network usage. The method includes obtaining accounting start-stop 
event data from two or more accounting servers via an information bus (p. 19, 11. 9-10). The 
information bus contains the accounting start-stop event data published by the two or more 
accounting servers (p. 14, 11. 17-19). The method further includes obtaining network flow data 
independent from said accounting start-stop event data from two or more routers within a 
network through intermediary netflow collectors (p. 19, 11. 9-10). The network flow data 
includes data regarding the number and type of packets utilized by a user (p. 12, 1. 12 to p. 13 1. 
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9). The method further includes correlating said accounting start-stop event data and said 

network flow data into a subscriber specific call detail record unique to said user by matching 

said accounting start-stop event data associated with said user with said network flow data 

associated with said user (p. 19, 11. 10-18). 
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Grounds of Rejection to be Reviewed on Appeal 



Whether Claims 1-13, 15, 16, 18, 23, and 36-49 are unpatentable under 35 U.S.C. 103(b) 
U.S. Pat. No. 5,828,737 to Sawyer in view of U.S. Pat. No. 6,338,046 to Saari et al. 
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Argument 

Rejection of Claims 1-13, 15, 16, 18, 23, and 36-49 Under 35 U.S.C. § 103(a) 

Independent claims 1, 13, 15, 16 5 18 5 and 23 recite, inter alia, obtaining network flow 
data independent from said accounting start-stop event data from two or more routers within a 
network through intermediary netflow collectors, said network flow data including data 
regarding the number and type of packets utilized by a user. These features are not disclosed in 
either Sawyer or Saari et al. , even if, arguendo, these references were properly combinable. 
These features are also not suggested by Sawyer or Saari et al. , considered singularly or in 
combination. 

The Examiner contends these features are disclosed by Sawyer . However, Sawyer 

discloses merely estimating the total amount of bandwith used during each communication. The 

Abstract of Sawyer recites: 

...measurements of the maximum amount of bandwidth used during 
predetermined time intervals are made during the course of each communication, 
with the maximum bandwidth measurements being summed to determine an 
estimate of the total amount of bandwidth used during the communication. The 
charge for the communication is then determined by multiplying the estimated 
total bandwidth measurement by a charging rate multiplier. 1 

The "Summary of the Invention" of Sawyer states: 

... periodic instantaneous bandwidth use measurements are made during the 
course of each communication. The periodically made bandwidth use 
measurements are summed to determine an estimate of the total amount of 
bandwidth used to carry the communication. A charging rate multiplier is then 
applied to the determined total bandwidth to obtain the charge incurred for the 
communication. 2 

Sawyer states further: 



Sawyer , Abstract, (emphasis added) 
2 Sawyer at col. 2 11. 1-19. (emphasis added) 
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The communications system 10 further includes a bandwidth use monitoring 
device (BUMD) 40 connected to either one or both of the nodes 12 and 14 and 
operable to make measurements for each communication carried over the 
communications link 18 of the instantaneous amount of bandwidth being used by 
the communication. The measurements may be made by the device 40 on either or 
both the reverse and/or the forward portions of the communications link 18. The 
results of these measurements are output to a processing device 42 associated with 
a billing center 44 for the system 10 that sums the bandwidth use measurements to 
derive an estimate of the total bandwidth usage amount for each communication. 
The bandwidth use monitoring device 40 and processing device 42 accordingly 
function as a bandwidth meter 46 measuring the total amount of bandwidth used 
for each communication. The processing device 42 then further functions to 
multiply the derived total bandwidth usage amounts by a charging rate to 
determine a charging amount to be billed for each communication, with the 
determined charging amount reported to the billing center 44 for the addition of 
other charge items and the generation of a bill to the user. 3 

Sawyer states further: 

The cellular telephone system 20 of FIG. 2 includes a similar functionality for 
determining a charging amount to be billed for each cellular telephone call. The 
mobile switching center 30 includes or is connected to a bandwidth use 
monitoring device 40 operable to make measurements, for each call carried over 
the air interface 26, of the instantaneous amount of bandwidth being used for the 
call. These measurements may be made by the device 40 on either or both the 
uplink and/or the downlink portions of the air interface 26. The results of these 
periodically made, instantaneous measurements are output to a processing device 
42 associated with a billing center 44 for the cellular system 20 that sums the 
bandwidth use measurements to derive an estimate of the total bandwidth usage 
amount for each call. The bandwidth use monitoring device 40 and processing 
device 42 accordingly function as a bandwidth meter 46 measuring the total 
amount of bandwidth used for each call. The processing device 42 then further 
functions to multiply the derived total bandwidth usage amounts by a charging 
rate to determine a charging amount to be billed for each communication, with the 
determined charging amount reported to the billing center 44 for the addition of 
other charge items and the generation of a bill to the subscriber. 4 

Thus, Sawyer discloses estimating the total amount of bandwith used during each 

communication by summing the results of periodic instantaneous bandwidth use measurements. 



3 Sawyer at col. 4 1. 51 to col. 5 1. 5. (emphasis added) 

4 Sawyer at col. 5 11. 6-28. (emphasis added) 
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As such, the network flow data in Sawyer does not include data regarding the number and type 

of packets utilized by a user as required by Claims 1, 13, 15, 16, 18, and 23. 

Accordingly, a prima facie case of obviousness has not been established, and the 
rejection of claims 1, 13, 15, 16, 18, and 23, and the claims dependent therefrom, based on the 
combination of Sawyer or Saari et aL is improper. 



Additionally, Sawyer teaches away from Claims 1, 13, 15, 16, 18, and 23. Again, 

independent claims 1, 13, 15, 16, 18, and 23 require that the network flow data include data 

regarding the number and type of packets utilized by a user. Whereas Sawyer teaches away from 

including in network flow data the number of packets used by a user, referring to such methods 

as "not particularly accurate." Sawyer recites: 

One solution to this charging concern is to charge the user based on the amount of 
packets of information in all of the packet transmissions 36 transmitted over the 
course of the communication. The use of packet amounts as the primary factor in 
determining the charge to be billed is also not particularly accurate in bandwidth- 
on-demand type communications systems because a user would be charged the 
same amount for a ten kilobyte packet transmission regardless of the length of the 
communication. This charging scheme accordingly does not take into account the 
minimum level (Min) of bandwidth used in maintaining the communication over 
the communications link 18 or the air interface 26 in between instances of 
successive packet transmissions 36. Even though minimal in nature, use of that 
minimum amount of bandwidth affects the capability (i.e., capacity) of the system 
to simultaneously handle other communications and thus should be reflected in 
the charge billed to the user for making the communication or call. 5 

For this additional reason, a prima facie case of obviousness has not been established, and the 
rejection of claims 1, 13, 15, 16, 18, and 23, and the claims dependent therefrom, based on the 
combination of Sawyer or Saari et ah , is improper. 



5 Sawyer at col. 4 11. 33-50. (emphasis added) 
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Independent claims 1, 13, 15, 16, 18 5 and 23 also recite, inter alia, correlating said 
accounting start-stop event data and said network flow data into a subscriber specific call detail 
record unique to said user by matching said accounting start-stop event data associated with said 
user with said network flow data associated with said user. These features are not disclosed in 
either Sawyer or Saari et aL even if, arguendo, these references were properly combinable. 
These features are also not suggested by Sawyer or Saari et aL considered singularly or in 
combination. As mentioned above, Sawyer in view of Saari et al. does not disclose or suggest 
said network flow data including data regarding the number and type of packets utilized by a 
user as required by Claims 1, 13, 15, 16, 18, and 23. Therefore, Sawyer in view of Saari cannot 
be said to disclose or suggest matching accounting stop-start event data associated with said user 
with such network flow data associated with said user. For this additional reason, a prima facie 
case of obviousness has not been established, and the rejection of claims 1, 13, 15, 16, 18, and 
23, and the claims dependent therefrom, based on the combination of Sawyer or Saari et al. , is 
improper. 
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Claims Appendix 

1 . A method for accounting for network usage comprising: 

obtaining accounting start-stop event data from two or more accounting servers via an 
information bus, wherein the information bus contains the accounting start-stop event 
data published by the two or more accounting servers; 

obtaining network flow data independent from said accounting start-stop event data from 
two or more routers within a network through intermediary netflow collectors, said 
network flow data including data regarding the number and type of packets utilized by a 
user; and 

correlating said accounting start-stop event data and said network flow data into a subscriber 
specific call detail record unique to said user by matching said accounting start-stop 
event data associated with said user with said network flow data associated with said 
user. 

2. The method of claim 1 wherein said obtaining accounting start- stop event data further 
comprises: 

parsing said accounting start-stop event data from the two or more accounting servers on a 

prescribed time interval; and 
publishing said accounting start-stop event data on an information bus. 

3. The method of claim 1 wherein said obtaining accounting start-stop event data further 
comprises: 
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collecting said accounting start-stop event data at a target device that subscribes to said 
accounting start-stop event data. 



4. The method of claim 2 wherein said obtaining accounting start-stop event data further 
comprises: 

collecting said accounting start-stop event data at a target device that subscribes to said 
accounting start-stop event data. 



5. The method of claim 1 wherein said obtaining network flow data further comprises: 

aggregating said network flow data at said intermediary netflow flow collector according to 
a service provider defined aggregation scheme. 



6. The method of claim 5 wherein aggregating said network flow data further comprises: 
basing aggregation of said network flow data on a specified time period. 



7. The method of claim 5 wherein aggregating said network flow data further comprises: 
basing aggregation of said network flow data on the Internet Protocol Layer 3 source 
address. 



8. The method of claim 5 wherein aggregating said network flow data further comprises: 
basing aggregation of said network flow data on the Internet Protocol Layer 4 destination 
address. 
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9. The method of claim 1 wherein said obtaining network flow data further comprises: 
filtering said network flow data at the intermediary netflow collector according to a service 

provider defined filtration scheme. 

10. The method of claim 1 wherein said obtaining network flow data further comprises: 
collecting said network flow data from the two or more routers and forwarding said network 

flow data to the intermediary netflow collectors; 
aggregating said network flow data according to a defined aggregation scheme; 
parsing said network flow data from said network flow collector; 
publishing said network flow data on an information bus. 

1 1 . The method of claim 10 wherein said obtaining network flow data further comprises: 
filtering said network flow data according to a service provider defined filtration scheme. 

12. The method of claim 1 wherein said correlating said accounting start-stop event data and 
said network flow data further comprises: 

reforming said call detail record to meet post-correlated applications. 

13. A method for accounting for network usage comprising: 

parsing accounting start-stop event data from an accounting server on a prescribed time 
interval; 

publishing said accounting start-stop event data on an information bus; 
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collecting network flow data independent from said accounting start-stop event data from a 

network router and forwarding said network flow data to a network flow collector, said 

network flow data including data regarding the number and type of packets utilized by a 

user; 

aggregating said network flow data according to a prescribed aggregation scheme; 
parsing said network flow data from said network flow collector; 
publishing said network flow data on an information bus; 

collecting said accounting start-stop event data and said network flow data at a target device 
that subscribes to said accounting start-stop event data and said network flow data along 
with accounting start-stop event data from a different accounting server and network 
flow data from a different router; and 

correlating said accounting start-stop event data and said network flow data into a subscriber 
specific call detail record unique to said user by matching said accounting start-stop 
event data associated with said user with said network flow data associated with said 
user. 

14. (Cancelled). 



15. An apparatus for accounting for network usage comprising: 

a means for obtaining accounting start-stop event data from two or more accounting servers 
via an information bus, wherein the information bus contains the accounting start-stop 
event data published by the two ore more accounting servers; 
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a means for obtaining network flow data independent from said accounting start-stop event 
data from two or more routers within a network through intermediary netflow 
collectors, said network flow data including data regarding the number and type of 
packets utilized by a user; and 

a means for correlating said accounting start-stop event data and said network flow data into 
a subscriber specific call detail record unique to said user by matching said accounting 
start-stop event data associated with said user with said network flow data associated 
with said user. 

16. An apparatus for accounting for network usage comprising: 

means for parsing accounting start-stop event data from an accounting server on a prescribed 
time interval; 

means for publishing said accounting start-stop event data on an information bus; 
means for collecting network flow data independent from said accounting start-stop event 

data from a network router and forwarding said network flow data to a network flow 

collector, said network flow data including data regarding the number and type of 

packets utilized by a user; 
means for aggregating said network flow data according to a prescribed aggregation scheme; 
means for parsing said network flow data from said network flow collector; 
means for publishing said network flow data on an information bus; 
means for collecting said accounting start-stop event data and said network flow data at a 

target device that subscribes to said accounting start-stop event data and said network 
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flow data along with accounting start-stop event data from a different accounting server 

and network flow data from a different router; and 

means for correlating said accounting start-stop event data and said network flow data info a 

subscriber specific call detail record unique to said user by matching said accounting 

start-stop event data associated with said user with said network flow data associated 

with said user. 

17. (Cancelled). 

18. An apparatus for accounting for network usage comprising: 

an accounting adapter in communication with two or more accounting servers; 
a network flow adapter in communication with two or more routers; and 
an integrating accounting adapter in communication with said accounting adapter and said 
network flow adapter. 

19-22. (Cancelled). 

23. A program storage device readable by a machine tangibly embodying a program of 
instructions executable by the machine to perform a method for accounting for network 
usage, said method comprising: 

obtaining accounting start-stop event data from two or more accounting servers via an 
information bus, wherein the information bus contains the accounting start-stop event 
data published by the two or more accounting servers; 
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obtaining network flow data independent from said accounting start-stop event data from 

two or more routers within a network through intermediary netflow collectors, said 

network flow data including data regarding the number and type of packets utilized by a 

user; and 

correlating said accounting start-stop event data and said network flow data into a subscriber 
specific call detail record unique to said user by matching said accounting start-stop 
event data associated with said user with said network flow data associated with said 
user. 

24-35. (Cancelled). 

36. The apparatus of claim 15, wherein said means for obtaining accounting start-stop event 
data further comprises: 

means for parsing said accounting start-stop event data from the two or more accounting 

servers on a prescribed time interval; and 
means for publishing said accounting start-stop event data on an information bus. 

37. The apparatus of claim 15 wherein said means for obtaining accounting start-stop event data 
further comprises: 

means for collecting said accounting start-stop event data at a target device that subscribes 
to said accounting start-stop event data. 
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38. The apparatus of claim 37 wherein said means for obtaining accounting start-stop event data 
further comprises: 

means for collecting said accounting start-stop event data at a target device that subscribes 
to said accounting start-stop event data. 

39. The apparatus of claim 15 wherein said means for obtaining network flow data further 
comprises: 

means for aggregating said network flow data at said intermediary netflow flow collector 
according to a service provider defined aggregation scheme. 

40. The apparatus of claim 39 wherein said means for aggregating said network flow data 
further comprises: 

means for basing aggregation of said network flow data on a specified time period. 

41. The apparatus of claim 39 wherein said means for aggregating said network flow data 
further comprises: 

means for basing aggregation of said network flow data on the Internet Protocol Layer 3 
source address. 

42. The apparatus of claim 39 wherein said means for aggregating said network flow data 
further comprises: 

means for basing aggregation of said network flow data on the Internet Protocol Layer 4 
destination address. 
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43. The apparatus of claim 1 5, wherein said means for obtaining network flow data further 
comprises: 

means for filtering said network flow data at the intermediary netflow collector according to 
a service provider defined filtration scheme. 

44. The apparatus of claim 15 wherein said means for obtaining network flow data further 
comprises: 

means for collecting said network flow data from the two or more routers and forwarding 

said network flow data to the intermediary netflow collectors; 
aggregating said network flow data according to a defined aggregation scheme; 
parsing said network flow data from said network flow collector; 
publishing said network flow data on an information bus. 

45. The apparatus of claim 15 wherein said means for obtaining network flow data further 
comprises: 

means for filtering said network flow data according to a service provider defined filtration 
scheme. 

46. The apparatus of claim 15 wherein said means for correlating said accounting start-stop 
event data and said network flow data further comprises: 

means for reforming said call detail record to meet post-correlated applications. 
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47. The apparatus of claim 1 8, wherein said accounting adapter is configured to obtain 
accounting start-stop event data from two or more accounting servers via an information 
bus, wherein the information bus contains the accounting start-stop event data published by 
the two or more accounting servers. 

48. The apparatus of claim 47, wherein said network flow adapter is configured to obtain 
network flow data independent from the accounting start-stop event data from two or more 
routers within a network through intermediary netflow collectors, the network flow data 
including data regarding the number and type of packets utilized by a user. 

49. The apparatus of claim 48, wherein said integrating accounting adapter is configured to 
correlate the accounting start-stop event data and the network flow data into a subscriber 
specific call detail record unique to the user by matching the accounting start-stop event data 
associated with the user with the network flow data associated with the user. 
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Related Proceedings Appendix 



None. 
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